Personal Data Protection (KVKK) Information Notice

At San Metal A.Ş. ("San Metal", the "Company"), we regard the protection of personal data as an inseparable part of our activities. We have prepared this Information Notice in our capacity as data controller under Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK").

The purpose of this Information Notice is to inform data subjects clearly and transparently about the purposes for which personal data processed by San Metal is used, with whom it is shared, and what rights data subjects have.

This Information Notice covers the personal data processing activities carried out across all of our Company's physical and digital operations. It applies to employees, customer and supplier representatives, visitors, website users and job applicants.

San Metal aims to embed a transparent, accountable and auditable culture of personal data protection throughout the organisation. To that end, the necessary technical and administrative processes are applied and employees receive regular training.

• Personal Data: Any information relating to an identified or identifiable natural person.
• Special Categories of Personal Data: Data listed in Article 6 of the KVKK, such as health, biometric and criminal conviction data.
• Explicit Consent: Consent relating to a specific matter, based on information and given freely.
• Data Controller: The person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
• Data Subject: The natural person whose personal data is processed.

Your personal data is processed in connection with the following activities and processes:

• Carrying out production, procurement and sales processes
• Managing human resources and personnel administration processes
• Ensuring physical premises and information security
• Finance, accounting and invoicing activities
• Maintaining communication with customers, suppliers and business partners
• Website analytics and improving the user experience
• Internal audit, reporting and quality control
• Fulfilling obligations arising from legislation

• Identity: First name, surname, Turkish ID number, date of birth, etc.
• Contact: Telephone, email and address details.
• Personnel Information: Personnel file, employment records, education and certification details.
• Customer/Supplier Transaction: Order, contract and invoice details.
• Financial: Bank, payment and current account details.
• Physical Premises Security: CCTV footage and visitor entry/exit records.
• Transaction Security: IP address, log records and access details.
• E-Commerce/Communication: Information submitted through web forms.
• Visual/Audio Recording: Photographs, video and audio recordings.
• Special Categories of Personal Data: Health and similar information processed only under legislation or with explicit consent.

Your data is processed within the framework of the following KVKK provisions:

• Being necessary for the conclusion or performance of a contract (Art. 5/2-c)
• Being necessary for the Company to fulfil its legal obligations (Art. 5/2-ç)
• Legitimate interest, provided it does not harm the data subject's fundamental rights and freedoms (Art. 5/2-f)
• Being expressly provided for by law (Art. 5/2-a)
• Being necessary for the establishment, exercise or protection of a right (Art. 5/2-e)
• Obtaining the data subject's explicit consent where none of the above grounds apply (Art. 5/1)

Personal data is collected by automated or partly automated means such as forms and applications on our website, contracts, email correspondence, system logs, closed-circuit television (CCTV) systems and cookies.

Under Articles 8 and 9 of the KVKK, your personal data may be transferred to the following parties, limited strictly to the purposes of processing:

Domestic Transfers:

• Suppliers and service providers
• Business partners
• Legal, accounting and consultancy firms
• Authorised public institutions and organisations
• Courts and judicial authorities

International Transfers:

• Information technology and analytics infrastructure providers

International transfers are carried out only where the security requirements stipulated by the KVKK are met.

Personal data is retained for the period stipulated by the relevant legislation or required by the purpose of processing. Once those periods expire, whichever of deletion, destruction or anonymisation is appropriate is applied under the "Retention and Destruction Policy".

San Metal applies the following technical and administrative measures to your data:

• Managing access rights on a "need to know" basis
• Firewall, antivirus and intrusion detection/prevention systems
• Regular penetration tests and security audits
• Personal data awareness training for employees
• Confidentiality undertakings and disciplinary policies

Our website uses strictly necessary, performance and targeting cookies. Non-essential cookies run only with explicit consent obtained through the cookie management platform. For details, please see our Cookie Policy.

Closed-circuit television (CCTV) systems and visitor entry/exit records are maintained on the Company premises for physical security and occupational health and safety purposes. The required information notices are displayed appropriately in the relevant areas.

Under Article 11 of the KVKK, you have the following rights as a data subject:

• To learn whether your personal data is being processed and to request information about it
• To learn the purpose of processing and whether the data is used in accordance with that purpose
• To know the third parties, in Türkiye or abroad, to whom the data has been transferred
• To request the correction of data processed incompletely or inaccurately
• To request deletion, destruction or anonymisation
• To request that correction or deletion be notified to the third parties to whom the data was transferred
• To object to an adverse outcome arising from analysis carried out by automated systems
• To claim compensation for damage suffered as a result of unlawful processing

To exercise your rights as a data subject, you may apply to our Company in writing via the "Data Subject Application Form", or by email to info@sanmetal.com.tr from your registered email address. Depending on their nature, your applications will be concluded within 30 days at the latest.

Without prejudice to the situations covered by Article 28 of the KVKK, the legislation provides that a data subject's rights may be restricted in certain cases. In such cases, our Company will inform you of the reason why your request could not be fulfilled.

This Information Notice takes effect on the date it is published on our website. It may be updated in line with changes in legislation or in our business processes. The current version is always published on this page.